[PATCH v3] sfnt2fon: Prevent reading past allocated buffer

[Nikolay Sivov]

I think the real issue here is that assumptions are made regarding
returned metrics and bitmap layout, like 'ascent' value. It's fragile
and could differ for different freetype releases.